CVE-2026-16178: IBM DataPower Gateway Out-of-bounds Write

Q: What access does an attacker need to exploit this issue?

The issue is remotely exploitable over the network and does not require privileges or user interaction. An attacker can trigger a denial of service by sending improperly validated input.

Q: Which DataPower Gateway releases are affected?

Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2.

Q: What is the expected impact if exploitation succeeds?

Successful exploitation can cause a denial of service. The provided severity vector indicates no stated confidentiality or integrity impact.

Published Sep 28, 2026

Updated

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper input validation.

Other sources

IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper input validation.

— IBM

Affected Software

4 affected components

IBM DataPower Gateway 10.6CD<=10.6.1 - 10.6.6

IBM DataPower Gateway 10.6.0<=10.6.0.0 - 10.6.0.10

IBM DataPower Gateway 11.0.0<=11.0.0.0 - 11.0.0.2

IBM DataPower Gateway 10.5.0<=10.5.0.0 - 10.5.0.22

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM DataPower Gateway to a version that resolves this vulnerability.
Fixed in 11.0.0.3
Upgrade
Upgrade IBM DataPower Gateway to a version that resolves this vulnerability.
Fixed in 10.6.0.11
Upgrade
Upgrade IBM DataPower Gateway to a version that resolves this vulnerability.
Fixed in 10.5.0.23

Event History

Sep 28, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 8, 2026

CVE Published

via MITRE·01:10 PM

Data Sourced

via MITRE·01:10 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7289775

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue is remotely exploitable over the network and does not require privileges or user interaction. An attacker can trigger a denial of service by sending improperly validated input.

Which DataPower Gateway releases are affected?

Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2.

What is the expected impact if exploitation succeeds?

Successful exploitation can cause a denial of service. The provided severity vector indicates no stated confidentiality or integrity impact.

CVE-2026-16178: IBM DataPower Gateway Out-of-bounds Write

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which DataPower Gateway releases are affected?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which DataPower Gateway releases are affected?

What is the expected impact if exploitation succeeds?